diff --git a/DEXTemplate.bt b/DEXTemplate.bt index 37c71ba..58e850f 100755 --- a/DEXTemplate.bt +++ b/DEXTemplate.bt @@ -4,12 +4,19 @@ // File: DEXTemplate.bt // Author: Jon Larimer // Tim Strazzere -// Revision: 1.3 +// Revision: 1.4 // Purpose: A template for analyzing Dalvik VM (Android) DEX files // // License: This file is released into the public domain. People may // use it for any purpose, commercial or otherwise. //-------------------------------------- +// Version 1.4 (2013-8-12) +// +// FIXED: +// - Fixed linked section to only color if section is not null or zero +// - Color the header_size to red if not expected 0x70 size, indicated +// "big ego"/section stuffer attack +// // Version 1.3 (2013-2-7) // // FIXED: @@ -469,10 +476,15 @@ typedef struct { SHA1 signature ; uint file_size ; + if(ReadUInt(FTell()) != 0x70) { + SetBackColor(cLtRed); + } uint header_size ; if(header_size > 0x70) { Warning("Header size appears be to larger than expected"); } + // Ensure we reset color to not bleed + SetBackColor(cLtGreen); uint endian_tag ; @@ -481,13 +493,15 @@ typedef struct { Warning("Invalid endian_tag %.8X, should be %.8X", endian_tag, ENDIAN_CONSTANT); } - - SetBackColor(cLtRed); + if(ReadUInt(FTell()) != 0 && ReadUInt(FTell() + 4) != 0) { + SetBackColor(cLtRed); + } uint link_size ; uint link_off ; if(link_size != 0 || link_off != 0) { Warning("A link section appears to be set, this is not supported"); } + // Ensure we reset color to not bleed SetBackColor(cLtGreen); uint map_off ;